CVE-2024-13293
The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (p...
Original description
The description as published by the source.
The module creates an endpoint on the site at /postfile/upload that accepts a POST request for uploading a single file into a specified file system (public, private, etc).
The module doesn't sufficiently protect against Cross Site Request Forgery
under allowing an attacker to trick a site user into uploading a file.
Affected packages
Packagist:https://packages.drupal.org/8
drupal/postfile
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2"}],"database_specific":{"constraint":"<1.0.2"}}]
References
- web drupal.org